aeat.adapters.outbound.aeat.sede._renta_web_open_safety module¶
Click-time safety enforcement for the Renta WEB Open driver.
Mission-critical: under NO circumstance may any calculation be submitted,
signed, presented, paid, or persisted to AEAT — even on the open simulator.
This module is the runtime belt-and-suspenders enforcement layer: every
button click in the driver routes through assert_click_target_safe,
which inspects the locator’s resolved text and blocks the click before
Playwright issues it if the text matches the forbidden-actions denylist.
The denylist mirrors the Spanish-language equivalents of the
AEAT_WRITE_FORBIDDEN_ACTIONS constant declared in
aeat.domain.calculations.registry._remote_state_guard. The runtime
copy here is the second line of defense: the policy registration is the
first (a click that bypasses this module would still need a policy that
allows it, and the open-simulator policy explicitly forbids these
actions). A hygiene test in the test suite confirms the driver code
never invokes Playwright’s locator.click() outside this safety
wrapper.
This module also installs a page-level safety net:
dialog auto-dismiss: any browser dialog (
alert,confirm,prompt,beforeunload) is dismissed without action;navigation guard: any navigation to URLs containing forbidden path fragments (
/Presentar,/Firmar,/Pagar,/Sign) raises before the request leaves the browser.
The defenses are intentionally redundant: each layer alone is sufficient to prevent submission; together they ensure that even a single layer’s failure cannot result in a real filing.
- async assert_click_target_safe(locator, *, stage, description, timeout_ms=5000)[source]¶
Inspect a locator’s text + URL before allowing a click.
Raises
SedeNavigationErrorif the locator targets a forbidden action. The check runs on EVERY click in the driver — there is no bypass mechanism. Adding an exception requires editingALLOWED_CLICK_OVERRIDESAND auditing the action’s read/write semantics first.